Location: Luxembourg

Employment Type: Permanent/CDI 

We are supporting a client who are currently looking for an IT Security Governance and Controls Specialist to strengthen the IT security framework within the First Line of Defence. The role focuses on implementing security policies, ensuring effective IT security controls, supporting regulatory compliance and improving overall security posture. You will work closely with IT teams, architects and the CISO within the Second Line of Defence and you will help embed security best practices across IT operations.

Key Responsibilities:

• Maintain and improve IT security policies, standards and procedures, ensuring alignment with applicable regulations and frameworks, including DORA, CSSF Circular 20/750, ISO 27001 and NIST.
• Review new IT architectures and technology solutions, providing recommendations to ensure security requirements are considered from the design stage.
• Manage the IT security control repository, monitor the effective implementation of controls across IT teams and coordinate remediation actions where gaps are identified.
• Coordinate internal and external IT security audits and prepare regular reports on compliance, control effectiveness and the Bank’s overall security posture.
• Promote a strong security culture by raising awareness and providing practical IT security guidance to IT teams.
• Collaborate with IT teams, architects and the CISO to ensure consistent application of security requirements and continuous improvement of the security framework.

Key Skills & Experience:

• Minimum 3 years of relevant experience, in IT security governance, GRC, IT controls or information security.
• Previous experience in a consulting firm, bank or financial institution is preferred.
• Good knowledge of DORA, CSSF requirements, ISO 27001 and NIST is required.
• Understanding of IT security controls, audit processes and security architecture is essential.
• Strong analytical, communication and stakeholder management skills are required.
• Relevant certifications such as ISO 27001, CISA, CISM, CRISC or CISSP are considered an advantage.
• Fluency in French is required.